Overview

overview

10

Static

static

10

7b652915c4...eb.exe

windows7-x64

10

7b652915c4...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85b177add44a49f07c6610191c064bbc.bin

  • Size

    1.2MB

  • Sample

    250108-bt2z3szmcm

  • MD5

    29eea6b9d0e2f052d46714885d5ea784

  • SHA1

    c40275f75032d4f8b6fa60bcdc71f57ac88326f4

  • SHA256

    66743ae3be6d419cec8ea33a6c265b1fad6eea2896d6f7bfaf981ee33df61e8a

  • SHA512

    68c7d25fe19d3790b64ce0fd2c55836940b6f12a9939b44018e4befc1efde8d725e0ca492c268b7f99ddc721f033c66f7e8670df961f3513896ac085678eaa09

  • SSDEEP

    24576:/Pg8YN4REglBDiaoAn1ogGxvc3QZULgvlztniGquR9TLZMAf:HZ04llJiaVnOgEU3QZ59zQGquLTLf

Score
10/10
quasarrattedspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ratted

C2

localhost:4782

87.97.126.177:4782
Mutex

48887e39-00c3-4c7d-9fbd-aa9bee5b1a88

Attributes
  • encryption_key

    CD36E224C70A801E8033FBB0E5129B1EA712AE1D

  • install_name

    Windows Font Manager.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Font Manager

  • subdirectory

    Fonts

Targets

    • Target

      7b652915c4539bf3c40a0700ca93c63e5fb1e56fdf0eb89567f7f0a8fb081aeb.exe

    • Size

      3.1MB

    • MD5

      85b177add44a49f07c6610191c064bbc

    • SHA1

      7766290221b9dafd7c0d6d983070f55863ed1b26

    • SHA256

      7b652915c4539bf3c40a0700ca93c63e5fb1e56fdf0eb89567f7f0a8fb081aeb

    • SHA512

      0a4d7e6a5c3e2d63a92f2ae57ab68561f47e827edffea6ea83aebac8286aab886c3bd98c6e791222411d272a925e8b3e03e14dc1b1017aaa449c1b0674717798

    • SSDEEP

      49152:TvChBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaUEGiBeHLoVd2THHB72eh2NT:Tv8t2d5aKCuVPzlEmVQ0wvwf/Gp

    Score
    10/10
    quasarrattedspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks